IT 14 022 Examensarbete 30 hp Juni 2014 Automatic Detection of Unspecified Expression Evaluation in FreeRTOS Programs Shahrzad Khodayari Institutionen för informationsteknologi Department of Information Technology . ... ... .... . . .. . . Acknowledgements This is a master thesis submitted in Embedded Systems to Department of Information Technology, Uppsala University, Uppsala, Sweden. I would like to express my deepest gratitude to my suppervisor Philipp Rümmer, Programme Director for Master’s programme in Embedded System at Uppsala University, for his patience in supporting continuously and generously guiding me with this project. I would like to appriciate professor Bengt Jonsson for reviewing my master thesis and offering valuable suggestions and comments. I would like to thank professor Daniel Kroening for helping me and providing updates of CBMC. Sincere thanks to my husband and my incredible parents who gave me courage and support throughout the project. Contents 1 Introduction..........................................................................................................1 Contributions.................................................................................................................3 Structure of the thesis report..........................................................................................3 2 Background...........................................................................................................5 2.1 Verification..............................................................................................................5 2.1.1 Model Checking......................................................................................5 2.1.2 Theorem proving.....................................................................................6 2.2 CBMC.....................................................................................................................6 2.3 FreeRTOS operating system.....................................................................................8 2.4 Sequence points..............................................................................................8 3 Unspecified side effects.......................................................................................11 3.1 Arguments Evaluation Order ..................................................................................11 3.2 A formal semantics for arguments evaluation order.................................................13 4 Algorithm of evaluation order side effect..........................................................17 5 Preparation of analysis ......................................................................................23 5.1 FreeRTOS..............................................................................................................23 6 Implementation...................................................................................................25 6.1 CBMC ..................................................................................................................25 6.2 CBMC extension....................................................................................................26 7 Evaluation and case study..................................................................................31 8 Related work.......................................................................................................33 9 Conclusion...........................................................................................................35 10 Bibliography.....................................................................................................37 List of Figures 2.1 The model-checking approach 6 3.1 Grammar G 14 3.2 Grammar rules 15 4.1 Operators type in a function’s arguments list 17 4.2 Evaluation order side effect algorithm 18 4.3 Expression Tree 19 4.4 Making Operators relation graphs for expression (a+b)||b++ 20 4.5 Making Operators relation graphs for expression ++c[i]-c[j] 21 4.6 Operators relation graphs 22 6.1 Data type of a node in ORG graph 28 6.2 Array indexes assertion 28 6.3 Enabling arguments checker 29 7.1 GCC 4.8.2 31 7.2 Coverity 7.0 32 7.3 Modified CBMC 32 Chapter 1 Introduction The majority of computer devices are embedded systems. These days cellphones, cameras, home appliances, robots, industrial machines, traffic lights, trains, airplanes, and many other devices mainly contain an integration of computer systems. Embedded systems are often complex and safety-critical. As both their hardware and software complexity are significantly increasing, reliability moves into the center of attention and needs to be tested properly. Testing could be done in different stages, while producing software and it is sometimes as complex and time consuming as developing the software. Therefore, it is more beneficial to find bugs at an early stage in software development and provide valuable feedback for developers, in order to find and fix such problems prior to building up the next modules or even next release. Sometimes bugs are due to a bad usage of a documented library or API, because of not reading the whole manuals or misunderstanding them. An other case could be not only a programmer's mistakes but also by reason of using complicated programming languages, like C/C++. In fact, while C/C++ are the most widely used languages for developing such systems, they are counted as highly prone to errors. These errors might lead to very serious consequences, including unpredictable and inconsistent program behaviors, run-time errors and even system crashes. Consequently effective detection of such errors is necessary. Many embedded system applications use a special operating system called Real Time Operating System (RTOS). FreeRTOS is an open source RTOS that is used for embedded platforms such as ARM, Cortex-M3, AVR and STM32. It is written mostly in C and offers a small and simple real time operating system. It provides one solution for many different architectures and development tools and it is known to be reliable. In thesis, we use FreeRTOS as a processor of targeting program which might contain unspecified behavior. For this purpose, we prepared a minimalist or simplified model of the FreeRTOS API in form of a C library. For achieving error detection goal, there are variable verification techniques. Using formal methods are well-known, which mathematically specify and verify these systems. They give us a proper understanding of a system and reveal inconsistencies, ambiguities, and incompleteness that might otherwise go undetected[1]. 1 One of the most widely used formal methods is model checking, a technique that relies on building a finite model of a system and checking if a desired property holds in that model. Bounded Model Checking (BMC) techniques are able to efficiently and statically detect the possibility of run time exceptions in low-level imperative code, i.e., due to erroneous use of pointers, arithmetic overflows, or incorrect use of APIs. One of the most successful tools for automatic verification that implements the bounded model checking (BMC) technique, is the C Bounded Model Checker (CBMC) used for ANSI-C/C++ programs. There is a class of defects that is detected by this CBMC, while many other verification tools have not unnoticed yet. For instance, among many features, we emphasize more on its ability to check array bounds even with dynamic size, pointer safety during conversion of pointers from and to integers and user-specified assertions; moreover it models integer arithmetic accurately, and is able to reason about machine-level artifacts such as integer overflow. In CBMC, any sort of checking appears as a specification that comes to a boolean formula, which is then checked for satisfiability by using an efficient SAT procedure. As a result, either a counterexample is extracted from the output of the SAT procedure, in the case that the formula is satisfiable, or if the formula is not satisfiable, the program can be unwound more to determine if a longer counterexample exists[2]. We extended the CBMC tool to check and automatically detect C/C++ code containing one form of unspecified behavior in the C/C++ standard which might go easily unnoticed by the programmers. According to the C/C++ standard, the order in which the arguments to a function are evaluated is unspecified and it depends on many factors like the argument type, the architecture, the platform and the compiler. The standard dictates that a C/C++ implementation may choose the order in which the function arguments are evaluated. It is the programmer's task to take care of them and make sure that the program does not depend on the order of evaluation. However, there is a warning flag in C/C++ compiler like GNU, -Wsequence-point, which warns about code that may have unspecified semantics because of violations of sequence point rules in the C and C++ standards. However, the current approach is suboptimal and many complicated cases are not diagnosed by this option. For instance, through this flag, the side effect among the array indexes are not evaluated precisely. If two indexes are expressions that might get same value at some point in the code, the flag is not able to detect this case. Eventually, we provide capability for our CBMC extension to be run on applications written in FreeRTOS. We added an option to the CBMC front-end to verify if a given C/C++ code contains no such kind of side effects in arguments of each